Security of transmitted electronic documents has been the subject of great attention in the data processing industry. The misuse or misappropriation of confidential information is a serious threat to electronic commerce. Even the perceived risk of insufficient integrity will render a data processing method unworthy for commercial use. System administrators and service providers have been responsible for creating policies and implementing procedures for ensuring the security of files transferred over a network. The majority of security measures has been focused on controlling access to infrastructure, such as a network domain or a storage media. For example, securing documents sent by e-mail was primarily accomplished by restricting access to a given e-mail account. Another common method is to compress or encrypt documents sent via e-mail. However, due to the unsecured nature of e-mail, many forms of business and transactions are still not conducted using e-mail messages and documents. Also, these kinds of policies do not have any effect on a user or a file after the document has been received via e-mail and made available for further processing.
Therefore, newer security architectures have emphasized providing security in the user environment at the application level, when the document is manipulated by the receiving party. Typically, point of use security methods require global coverage of an IT system with the corresponding installation of central tools and distributed agents. This kind of additional digital rights management infrastructure added to an IT system requires a large initial investment and significant administration effort over time. A centralized system can also be very inflexible and may not meet the specific needs of individual stakeholders. For example, if the system architecture requires that every document be registered with the authenticating server, then the system must rely upon the authenticating server for rights management policies. Such an architecture is inherently limited to securing participants within the domain, which inherently limits the scope of the security provided. Thus, there is a need for a simplified, decentralized method for securing e-mail messages and documents at their point of use, that can be universally used by any recipient of an e-mail message.
A common problem of practicality when transmitting encrypted content is that the sender and recipient are required to exchange keys in advance of the actual transmission. If a sender wants to send an encrypted document securely to a recipient, prior art methods have required that the sender possess the public key of the recipient before the encrypted content is transmitted.
Another aspect of digital rights management that has yet to be addressed is the time-dependent nature of many usage rights policies. When the digital rights to a document that already has been transmitted need to be changed, prior art systems have not offered simple, transparent solutions. For example, a frequent requirement in business communications is the widespread distribution of documents in advance of a specific date when such documents may be accessed by a large number of recipients. There has been no solution available that provides a robust, integrated, and automated solution to this common scenario.
Therefore, there is a need for a simple, flexible digital rights management system for transmitting documents and messages via e-mail, such that users may freely exchange encrypted data. The system should be decentralized and enable flexible management of digital rights over time, without requiring a global IT installation and additional administration.